Serious Security

January 17, 2013

I almost long for days when security was this simple.

There’s an interesting piece at Wired on hackers and their impact on security. Despite the constant hacks and cracks of passwords, the regular lectures and pieces written on the subject, many people refuse to use separate passwords on every site, or choose long passphrases, or implement many of the best practices that are published on security. Some of that might be a lack of knowledge, but much of it is likely explained by behavioral economics.

Most people are never hacked and don’t have issues. Even if they do experience some problem, they can often recover fairly easily. Lots of hacks are just annoying, like using your email account to send SPAM, akin to random vandalism. As a result, many people don’t bother to change their habits. It might also be a tendency that’s hard-wired in our personalities. I’ve educated friends on passwords and given them Password Safe. A few use it religiously, but others keep forgetting, preferring to keep regenerating and changing passwords or re-using them.

To solve some of these issues and create the behavior that we want, there are suggestions in the article for software designers. One is requiring stronger mechanisms up front, another suggests perhaps changing from alphanumeric pass-phrases to image based ones. One poses the idea of enforcing penalties on users. These might be ways in which we can convince software users to take security more seriously. If it’s true that software is eating the world, then perhaps the designers and developers should do their part to help make sure security is a part of the new world.